Users are seeing the option to add ("+") and remove ("-") target permissions in the CA Identity Portal Access Catalog even when they do not have the access rights to do so.
If a user already has the target permission, the remove "-" option appears.
If a user does not belong to the target permission, both the "+" and "-" options appear.
Component: CA Identity Portal
You can change this behavior by enabling the strict cart mode.
In the Identity Portal Management Console, go to Setup -> Gui Configuration, under the User Related -> General Info tab find the “strict_cart_mode” attribute and change its value to “true”.